CVE-2026-18051
CriticalCVSS 10.0Exploitation Probability (EPSS)
Low risk8th percentile - higher than 8% of all known CVEs
Summary
The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path used to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target name. On Apache, the same flaw overwrites the site's .htaccess files, which breaks the site and can strip hardening rules that other security measures rely on.
Risk Assessment
An attacker can overwrite critical files, leading to site outage, data loss, or removal of security hardening.
Recommendation
Update the W3 Total Cache plugin to version 2.10.5 or later to fix the path validation.
Original NVD description (English source)
The W3 Total Cache WordPress plugin before 2.10.5 does not properly validate the request path it uses to build cache file names, allowing unauthenticated attackers to write a file into any existing directory on the server, inside or outside the web root, overwriting whatever occupies the target name. On Apache, the same flaw overwrites the site's .htaccess files, which breaks the site and can strip hardening rules that other security measures rely on.